Microsoft Update Kills Firewall + Network

[Nick_Parker]

I've just done a windows update on my Exchange Server (Hyper-V, Windows Server 2008 64bit, Exchange 2007) restarted them and...

Something has gone funny with the network. I can ping any other machine from the Exchange Server, but nothing can ping or connect to the Exchange Server.

So I figure the update has changed something on the firewall, open up the firewall settings, "The firewall service is not running".

So I go along to services, try and manually start the Stopped Windows Firewall Service (which is set to automatic) and I get this an error message, go and look in the System Log Files and this is the error:

 

the windows firewall service terminated with service-specific error 13 (0xD)

 

I've just tried to uninstall the last 3 updates, didn't solve anything

 

Anybody else experienced this? Anybody have any ideas on how to fix this?

 

Any help would be greatly appreciated!

[Nick_Parker]

I'd like to emphasis that this is urgent please, nobody can access the exchange server

[SYNACK]

Corrupted firewall rules in the reg maybe (disclaimer - backup reg first):

Here is a possible solution. I got the same error. To fix it, I had to

delete the existing firewall rules in the registry. It worked in my

case, but since it involves registry changes, you have to be careful. It

-may- not work in your case. Also some rules which were manually added

will need to be re-created.

 

Here are the steps:-

 

1. This solution is for Windows Firewall error in Vista home edition,

as appearing in Event Log: "The Windows Firewall service terminated with

service-specific error 13 (0xD)."

 

2. Check in Security Event Log (Event Viewer->Windows Logs->Security).

Is there is any error with Event Id 5027 or 5028? The error message is:

"The Windows Firewall Service was unable to retrieve the security policy

from the local storage. The service will continue enforcing the current

policy. Error Code: 2147942413"

 

If there is no such error in Security log, *do not* proceed further on

this solution.

 

3. Open Registry Editor (Start->Run->regedit). Navigate to

HKLM\System\CurrentControlSet\Sevices\SharedAccess\Parameters\FirewallPolicy\FirewallRules.

 

You will see a bunch of values in the right pane there. Windows

Firewall is not able to load these rules, possibly because of some

corruption.

 

4. Take a backup of these registry entries. Right Click on

FirewallRules node in the left pane. Click on export. Save the file.

Backup may be required to restore values, in case something goes wrong

later.

 

5. Delete the rules in the left pane: Select 2nd row from top. Press

Ctrl Shift End. Press Delete.

 

6. Start Services MMC (Start->Run->Services.msc). Select "Windows

Firewall" ->Right Click->Start. Firewall service should start now.

 

7. To restore the default set of rules, click on Start->Type Windows

Firewall in the search box. Click on "Windows Firewall"

 

8. Click on "Allow a program through Windows Firewall". Click on

Advanced Tab->Restore Defaults.

 

Some programs will need to be manually allowed in the Firewall

settings.

The Windows Firewall service terminated with service-specific error 13 (0xD). (cannot start firewall)

 

Vista but cool apply given their shared heritage.

[SYNACK]

There is also this:

Windows Vista Firewall Fails To Start At Startup

[Nick_Parker]

No Luck - I already tried that earlier

[Nick_Parker]

Going to have to give MS a call, just realised it's the Domain Controller as well!

[AngryTechnician]

If you have System Restore enabled then I might be tempted to give that a try. Could also try issuing an sfc /scannow command to check for mucked up system files.

[Nick_Parker]

Thanks AngryTechnician,

 

As far as I know, Server 2008 doesn't support restore points?

Am busy running the scan now, thanks for the suggestion, will post results shortly

[Nick_Parker]

No Luck

[Michael]

Have you rebooted after uninstalling those updates?

[Nick_Parker]

Yep - numerous times

[Michael]

Checked the Event logs?

[kmount]

I suppose a little out of the scope but have you tried rebooting the HyperV physical host? (I've seen problems mainly on VMWare type installations where the bridged network connection has failed causing odd connectivity issues etc beyond phy<->virt)

[Nick_Parker]

I haven't tried - I'm afraid to!

The last 2 servers I restarted have lost their network and I need to be able to access the Hyper-V server so I can still access the DC & Exchange servers to work on them.

The odd thing is, the network on the Virtual Machines works going out, just not coming in.

[kmount]

That's fair enough, I'd be scared to!

 

I suppose creating a new image, logging into it, rebooting it, logging in again and then fully windows updating it and then rebooting to see if it has the same issue would be a useful movement forward.

[Nick_Parker]

That's actually a good idea, let me give that a try, thanks!

[kmount]

Good Luck Nick.

[TheScarfedOne]

Thats odd - I had the same thing happen on my exchange box on svr 08 this afternoon too. The only difference was mine was a physical not a virtual box. Same behavior tho - can get out of it to other devices, but not to it from others. Firewall showing as off. Attempting to shut the box down crashed it, so needed hard off (which always bothers me esp with exchange!!)

 

After a very long boot up and services start - it eventually came back online, but something funny is goin on....

[kmount]

Now that sheds some daunting light onto the situation.

[linkazoid]

We had this problem with a few of our servers a couple of weeks ago... But they were 2003.... but to solve it we uninstalled TCPIP...

 

Start - Run - CMD -

 

netsh int ip reset c:\resetlog.txt

 

You may want to try this..

 

 

Michael

[Nick_Parker]

Thats odd - I had the same thing happen on my exchange box on svr 08 this afternoon too. The only difference was mine was a physical not a virtual box. Same behavior tho - can get out of it to other devices, but not to it from others. Firewall showing as off. Attempting to shut the box down crashed it, so needed hard off (which always bothers me esp with exchange!!)

 

After a very long boot up and services start - it eventually came back online, but something funny is goin on....

 

Thanks for the suggestion, I've tried rebooting and shutting down the Virtual Servers, as well as the Host Server

[Nick_Parker]

We had this problem with a few of our servers a couple of weeks ago... But they were 2003.... but to solve it we uninstalled TCPIP...

 

Start - Run - CMD -

 

netsh int ip reset c:\resetlog.txt

 

You may want to try this..

 

 

Michael

 

Thanks Linkazoid, I gave it a try, still the same problem tho

[Nick_Parker]

In case any of you are interested, this is the response from Microsoft so far (which haven't fixed the problem) but may help some of you if you have the same problem:

 

Please run the following commands, one at a time, from an Administrative Command Prompt:

reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /f
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" /f
rundll32.exe setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf
netsh.exe firewall reset

[Nick_Parker]

This is the 2nd Email from Microsoft, also didn't help solve the problem:

 

The network connectivity issue could also be caused by Scalable Network Pack Features (Task Offloading, Receive Side Scaling, etc).  Please do the following on the server to disable the SNP features, and increase the number of available ports:

1.) Select and Copy the text in the block below:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"EnableWsd"=dword:00000000
"DisableTaskOffload"=dword:00000001
"DisableLargeSendOffload"=dword:00000001
"EnableTCPChimney"=dword:00000000
"EnableRSS"=dword:00000000
"EnableTCPA"=dword:00000000
"TcpTimedWaitDelay"=dword:0000001e
"MaxUserPort"=dword:0000fffe
"SackOpts"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
"MaxFreeConnections"=dword:00000064
"MinFreeConnections"=dword:00000020

2.) Open Notepad (Start->All Programs->Accessories->Notepad).
3.) In Notepad, click Edit, click Paste.
4.) Click File, click Save As, type in DisableSNP.reg as the Filename, select All Files (*.*) as the File Type, select Desktop as the Destination, click Save. Exit Notepad.
5.) Double-click the DisableSNP.reg file to merge the changes and update the registry.
6.) Restart the server for the changes to take effect.

[k-strider]

Have you tried changing the network adapter from the Hyper V one to a Legacy Network Adapter and see if that makes any difference? encase there's a problem between the driver for the NIC and the updates?